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CENTRAL INTELLIGENCE AGENCY 
WASHINGTON, D.C. 20505 


Mr. Steven Garfinkel 

Director, Information Security 
Oversight Office 

General Services Administration 

18th §& F Streets, N.W. 

Room 6040 

Washington, D.C. 20405 


Dear Steve: 


The survey questions you forwarded to me concerning your study on the 
use of automated data processing equipment (ADP) systems in information 
security systems have been answered and are enclosed herewith. Since this 
was a preliminary survey, I did not require detailed responses from the 
components providing information since to gather precise information would 
have been a rather lengthy process. 


If additional information is required, we shall be happy to assist in 
any way. 


Sincerely, 


IS} Thomas H. White 
Thomas H. White 
Director of Information Services 
Directorate of Administration 
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USE OF ADP EQUIPMENT/SYSTEMS * 
IN INFORMATION SECURITY PROGRAMS 


ACENONS 0. Central “ImveNla pence ApiCy oao5 ag 2 
ACTIVITY, OFFICE, DIVISION: Office of Information Services, DDA 


NAME AND TITLE OF RESPONDER: Thomas H. White, Director of Information Services 


DATE: 31 March 1981 — , 
y , *NOTE: F OR THE PURPOSE OF THIS STUDY, ADP EQUIPMENT/SYSTEMS DOES NOT INCLUDE WORD 
r PROCESSING EQUIPMENT. 
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1. When did you start using ADP computer 
equipment in the management of your 
information security program?. 1975 


ses sess SP a a oe ey ge 


2, How did you determine the need for 
computerization in your information 


ne > : 
security program: Too much data for manual methods. 


3. Did you have any difficulties in 
getting authorization for use of 


computer systems? What were the 


major difficulties? No. Getting our people trained in the use of this 


equipment and keeping these skills current was 
(and is) our biggest concer. 
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4. What aspects of the information security 
program are being supported by ADP systems? 
(Brief explanation) 
a. Control system for accountable classified material? 
b. Inventories? Top Secret? Secret? Confidential? 
c. Personnel security clearances? 
d. Control of passes? 

e. Mandatory review for declassification? 

f. Systematic review for declassification? 

g. Other declassification programs? 

h. FOIA requests involving classified information 

i. Other (specify) 


relate St ay St leh eg ate eT a a, b, c, d, e, f, andh. 


) Our system for accounting and controlling Top Secret Agency documents generates via Batch mode, inventory 
listings for each of our user offices or control points. Our system does have on-line input/edit features. 
We then review these inventories with individual offices and later conduct audits of same. . 


Our other systems for personnel clearances, control of "identification" 


documents, mandatory and systematic 
review and FOIA requests are "store and retrieval" systems. 


RS 
5, Are reports generated as a result of ADP processing? 


What kinds? Are they used by other agencies? (If so, 
explain.) How frequently are they updated? 


Yes, exception reports taken from 

SMF audit trail information. Not : 
. used by other agencies. Reports 

generated weekly. 


y Reports for mandatory and systematic review are generated and updated on an as needed basis. Some systematic 
r 


review reports are used by other agencies to determine what the review decision was so they could properly handle 
our documents in their possession. : 


our documents in their POSSCSS 10M 


6. Has the use of ADP systems in your information security 
program been evaluated for cost effectiveness? ; 
(If so, explain.) No - for security. 
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7. Is manual processing of data a practical 
alternative in times of ADP computer ~ 


system outages? | . No. : 
a 
8. How many members of the security staff have had All of the Information Systems Security Group. 

formal training in computer science? How many are 

qualified to operate a terminal to make inputs and . All of the Information Systems Security Group. 

retrieve information? 
) Numerous others in additional units have been trained 
: and are qualified. 


et 
9, What problems have you encountered in application of . 

ADP to the information security program (management 

and operational}? : oS Lack of adequate resources for size of job. 


el 


10. What benefits have you encountered in application of ADP 
) to operation and management of the information security 
program, i.e. decreased costs, decreased personnel staff, 


: ? 
improved controls, etc.‘ Improved controls. 


ee ee a ee 


ai, Would you recommend use of computers to agencies with 


limited information security programs? (Costs vs. benefits?) : ' 
If so, in what areas? “Yes - audit trail - absolute must. 
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